My Docker Stack

Share your Projects!
121

Alright…

I ran letsencrypt from the docs at the home assistant site:

But I modified it for the correct challenge type.

here is the command:

sudo docker run -it --rm -p 80:80 --name certbot -v "/etc/letsencrypt:/etc/letsencrypt" -v "/var/lib/letsencrypt:/var/lib/letsencrypt" quay.io/letsencrypt/letsencrypt:latest certonly --standalone --preferred-challenges http-01 --email my email -d mydomain.duckdns.org

It was kind of successful.

I now have keys at the directory in the command above (/etc/letsencrypt/live/.duckdns.org).

after properly forwarding my ports on my router (router 80 to host 80 and router 443 to host 8124), going to mydomain.duckdns.org/states gives me this:

webserver

Does anybody know what the correct next step is to get this working?

122

@Corey_Johnson

What did you do to finally get yours working?

123

Is your goal to actually use Home Assistant to handle your certificate/SSL or to use a reverse proxy? You seem to be confusing them. If you are using Home Assistant you need to modify your configuration yaml to support SSL directly from Home Assistant. If you are using a reverse proxy you dont have to change anything in home assistant, just set up the proxy.

I highly recommend using a reverse proxy over using SSL in Home Assistant.

124

He set up a reverse proxy…

125

So I just run a docker with the nginx image?

If so then where is the configuration file located that I need to change with your examples above?

then the keys exist for letsencrypt on the host machine and the reverse proxy handles the encrypted traffic?

Don’t think I’m leaving anyone in the cold here either.

as soon as I figure all the steps required I’m posting up a procedure to help others work thru this.

this is ridiculous that this is so complex and the documentation for it is almost non-existant and contradictory.

126

Yes

That’s part of the NGINX container configuration that you do. You tell it where the conf files reside and you modify as you see fit.

Yeah, you would use -v bind mounts to point to where your certs are and configure NGINX to handle it.

What do you mean? Setting up NGINX reverse proxy tutorials are a dime a dozen. There is nothing inherently different about setting up an NGINX reverse proxy for Home Assistant than any other site you want to proxy for. You are confused because you aren’t separating the terminology or concepts.

Home Assistant is a web app running on your network, on an IP and port.

NGINX will reverse proxy port 80/443 to WHEREVER you tell it to, including to the web app mentioned above.

I have mentioned numerous times that with an NGINX reverse proxy, it can handle ALL your SSL needs for home assistant, and you are not required to use your EXTERNAL hostname to access it, and you don’t have to change anything in the Home Assistant configuration. In fact, you can still access it internally using normal HTTP not HTTPS and nothing will be broken, unlike when you set up the HASSIO DuckDNS add-on…

You just need to separate and understand how the pieces fit together. They are all separate, but work together to create what you want. You just have to tell it what you want.

127

Ok thanks for the help. Really. It is much appreciated.

I’ll dive into the next steps here and see where I land.

128

Yes! I can access internally via http://xxx:18122 or via www with https://xxxx

129

What are the benefits of using nginx if Home Assistant is the only exposed service I have? I understand the additional benfits with multiple services and services that don’t support ssl directly, just not seeing what it does for me if I only have port 8123 open now with Let’s Encrypt cerrtificates. I’m sure I’m overlooking something with security.

130

Did you use the linuxserver/letsencrypt image along with the nginx docker image to get it working?

Can you possibly provide a docker run command(s) with all the options and arguments you used for both of the images to finally get it working?

131

Let’s say you set your certificates on Home Assistant, and enforce it to use HTTPS. This requires a domain name (publicly accessible for Let’s Encrypt to work, or to get a trusted cert at all). Once you have configured Home Assistant to use SSL and this domain name it is ONLY accessible via this domain name, which means a couple of things:

  1. Your router has to support hairpin or loopback NAT in order for you to connect to the domain name from internally (alternatively, you can set up your internal DNS to handle the domain name resolution to your internal IP)
  2. Any apps that access your Home Assistant (looking at you node-red) require going out to resolve the name, and use the same method of access you do for your browser (either hitting the loopback/hairpin NAT or you have to set up an internal DNS)

Using Reverse Proxy, let’s say one day you want to setup something like NextCloud for your family to use, you just create another config, reverse proxying it to your NextCloud instance, get your certs, and bam, you are done. 2 different services, both using standard https port 443 accessible via subdomain names…

132

how do you you have yours set up and have access thru duckdns and letsencrypt without Nginx?

I have followed the instructions from the link you provided above (the Home Assistant docs) and have created certs. I forwarded port 443 to 8124 on the host machine. but when I try to access it thru my duckdns domain I get the picture I posted above.

On the RPI I was using before, all I had to do was point the config files to the certs directory and forward the port in the router and all was good. I don’t know how to point my config in to the certs file outside of the docker container.

Do I just need to add the path on the host where the certs are located to the HA config file like I did before?

edit: apparently that last part won’t work. I just tried it and got a config error.

but that is progress. I think…

133

Did you configure Home Assistant to point to your SSL certs? Did you tell it to use HTTPS?

Again, you should be using BIND MOUNTS. I keep saying it and you are not picking up on it.

Let’s say you want your certs to live in a directory called /certs in your docker container. On your host, you do -v /path/to/certs:/certs then everything inside your docker container will access the certs using /certs

bind mounts…

134

OOHHH…Ok.:thinking:

I think I’m starting to get it. :crazy_face:

here is the docker command i just tried:

docker run -d --name=“home-assistant” -v /docker/ha-config:/config -v /etc/letsencrypt/live/mydomain.duckdns.org:/certs -v /etc/localtime:/etc/localtime:ro --net=host homeassistant/home-assistant

the certs are located in the /etc/letsencrypt/live/mydomain.duckdns.org directory.

my pertinent part of configuration.yaml file is:

http:
  api_password: !secret http_password
  server_port: 8124
  base_url: mydomain.duckdns.org:8124
  ssl_certificate: /certs/fullchain.pem
  ssl_key: /certs/privkey.pem

now I get the following error:

2018-02-22 13:30:07 ERROR (MainThread) [homeassistant.config] Invalid config for [http]: not a file for dictionary value @ data['http']['ssl_certificate']. Got '/certs/fullchain.pem'
not a file for dictionary value @ data['http']['ssl_key']. Got '/certs/privkey.pem'. (See /config/configuration.yaml, line 41). Please check the docs at https://home-assistant.io/components/http/

And to be complete I forwarded port 443 on the router to 8124 on the host IP. and port 80 to 80 on the host.

135

why does this directory exist on the host? is this where you mapped your letsencrypt to? What did you use to get your certs?

136

I followed the instructions on the home assistant docs page that I posted above to get the certs with this command:

sudo docker run -it --rm -p 80:80 --name certbot -v "/etc/letsencrypt:/etc/letsencrypt" -v "/var/lib/letsencrypt:/var/lib/letsencrypt" quay.io/letsencrypt/letsencrypt:latest certonly --standalone --standalone-preferred-challenges http-01 --email [email protected] -d hass-example.duckdns.org

Should I rerun the command and put the certs in the ha configuration file I specified for my HA install (i.e. /docker/ha-config/certs/)?

137

I’m not sure why they would have you map volumes to directories that don’t exist on the host unless you have let’s encrypt installed…seems silly.

138

There’s lots of that going around these days…

Anyway, I tried to rerun the letsencrypt command using “/docker/ha-config/certs:/certs” and it reaquired new certs and put them in that directory under “/docker/ha-config/certs/live/mydomain.duckdns.org/”.

i changed the config to the following:

http:
  api_password: !secret http_password
  server_port: 8124
  base_url: mydomain.duckdns.org:8124
  ssl_certificate: /certs/live/mydomain.duckdns.org/fullchain.pem
  ssl_key: /certs/live/mydomain.duckdns.org/privkey.pem

and I still get the same error.

my HA config directory is at /docker/ha-config/

am i not understanding how to map the folder structure to point the http config to the correct place?

139

But if you put the certs in your config directory then the path would be your config directory not /certs

Hold on. You mounted a volume that’s already mounted…

140

Not really sure what you mean there but, i tried another iteration:

letsencrypt command:

sudo docker run -it --rm -p 80:80 --name certbot -v "/docker/letsencrypt:/etc/letsencrypt" -v "/var/lib/letsencrypt:/var/lib/letsencrypt" quay.io/letsencrypt/letsencrypt:latest certonly --standalone --preferred-challenges http-01 --email myemail -d mydomain.duckdns.org

the certs are now located in the following directory:

/docker/letsencrypt/live/mydomain.duckdns.org/fullchain.pem
/docker/letsencrypt/live/mydomain.duckdns.org/privkey.pem

the home assistant command:

sudo docker run -d --name="home-assistant" -v /docker/ha-config:/config -v /docker/letsencrypt/live/mydomain.duckdns.org:/certs -v /etc/localtime:/etc/localtime:ro --net=host homeassistant/home-assistant

the configuration.yaml section:

 http:
  api_password: !secret http_password
  server_port: 8124
  base_url: mydomain.duckdns.org:8124
  ssl_certificate: /certs/fullchain.pem
  ssl_key: /certs/privkey.pem

still getting the same error:

2018-02-22 15:30:42 ERROR (MainThread) [homeassistant.config] Invalid config for [http]: not a file for dictionary value @ data[‘http’][‘ssl_certificate’]. Got ‘/certs/fullchain.pem’
not a file for dictionary value @ data[‘http’][‘ssl_key’]. Got ‘/certs/privkey.pem’. (See /config/configuration.yaml, line 41).